Banks dragging feet on reporting breaches: ASIC

Banks are taking an average of more than four years to detect and report breaches, ASIC has told the bank inquiry.

The big four banks and other large financial institutions are taking an average of more than four years to detect and report breaches of their licenses, the corporate regulator has told the banking royal commission.

In a witness statement tendered to the commission, Australian Securities and Investments Commission deputy chairman Peter Kell slammed the big industry players, saying they “too often take overly technical legal points, or fail to make timely breach reports, or fail to constructively respond to notices for the production of documents”.

He called for ASIC to be given tough new powers to clean up the industry, including the ability to tell financial services licensees not to accept new clients.

Since June 2016, ASIC has been conducting a “breach reporting surveillance project” across 12 institutions — including the big four banks — which is due to be finished in July, Mr Kell said.

June 26, 2014

Royal Commission timeline

The Senate economics committee calls for a royal commission following a lengthy inquiry into ASIC’s performance that focused on financial planning scandals at the CBA.

April 21, 2016

Royal Commission timeline

In an attempt to stave off continuing calls for a royal commission, the Australian Bankers Association announces former senior public servant Ian McPhee will oversee an overhaul of industry standards and practices.

November 30, 2017

Royal Commission timeline

After years of denying a royal commission is needed, the banks write to Prime Minister Malcolm Turnbull asking for one. He obliges.

February 12, 2018

Royal Commission timeline

Commissioner Kenneth Hayne formally opens the inquiry and sets the tone by laying into the big banks for failing to provide all the information he wanted in time.

March 13, 2018

Royal Commission timeline

The commission’s first full public hearings hear about consumer credit issues including a home loan fraud ring among NAB bankers in Western Sydney and out-of-control mortgage brokers at CBA subsidiary Aussie Home Loans.

April 16, 2018

Royal Commission timeline

Second round of hearings kicks off with a focus on one of the industry’s most scandal-prone sectors, financial planning.

Among the projects “key preliminary findings” are that the average time taken from a breach occurring to the institution identifying it as needing investigation was 1,552 days — or just over four years.

On average it took an additional 123 days — or about four months — to lodge a breach report with ASIC.

The law requires financial services licensees to lodge reports with ASIC within 10 days of becoming aware of a serious breach.

While it took institutions an average of just 18 days to fix their systems once a problem was identified, remediation for customers was much slower, taking an average of 217 days before the first payment was made to a customer.

“ASIC considers that these preliminary findings tend to confirm its concerns about the timeliness and consistency of breach reporting,” Mr Kell said.

He took aim at the culture of the industry, which has already emerged as a key focus of the royal commission.

“From time to time, for instance, ASIC considers that the focus of the large financial services entities is too narrowly and pedantically on technical legal compliance, which results in an emphasis on technical, legal arguments about whether particular conduct or practices are ‘lawful’, rather than, whether they are producing good outcomes for their customers or are, in a broader sense, fair or consistent with the underlying policy or intent of the law,” he said.

“Such an attitude can play out in many different ways, including in negative impacts of conflicts of interest going unchecked, delays or failures, legalistic approaches to remediation and failures to proactively address known industry problems.”